Antibot

[ossftw]

Earlier today I was given access to Antibot.ts from https://multiplayerpiano.net. So, I rewrote it for compatibility within NodeWorldOfText. To circumvent the issue of AI-indexing and overall reverse-engineering, I came up with the idea to put the client_checks and bot_globals in nwotdata/settings.json. As you may notice, these arrays are not in settings_example.json. This is intentional. I have made it so that if the antibot object is not written into nwotdata/settings.json, the antibot is disabled. This also gives fork maintainers more freedom per instance.

How it works (as of now): when a client connects, the server sends an obfuscated JavaScript challenge (todo: change module) (antibot_challenge) containing 3 randomly-selected browser environment checks (from client_checks) and all automation-tool detection checks (from bot_globals). The client must eval the code in a browser context (bot globals cause it to return 0, fail) while passing client checks contributes to a hash that gets sent back as an antibot_response. The server verifies the hash matches. if it does, the connection is marked verified and all subsequent msgs pass through, otherwise every msg is dropped.

Todo:

• Antibot whitelists, allowing certain connections (@system2k, do you think that the whitelists should be by token, user, or what?) to pass through without being checked